Bug in plain text passwords

Message Topic Search Topic Options Post Reply Create New Topic Printable Version Translate Topic


   Hi, 
 
I Thought you would like to know that if you use plain text passwords (blnEncryptedPasswords = False) then the code to update passwords in register.asp will not work correctly as it sets the new password to <password><salt> rather than just <password> (See below)
 
Cheers,
 
Ben
 

'If the password doesn't match that stored in the db then this is a password update
         If rsCommon("Password") <> strEncryptedPassword AND blnConfirmPassOK Then
                  'Generate new salt
                  strSalt = getSalt(Len(strPassword))
           'Concatenate salt value to the password
             strEncryptedPassword = strPassword & strSalt
           'Re-Genreate encypted password with new salt value
              If blnEncryptedPasswords Then strEncryptedPassword = HashEncode(strEncryptedPassword)
                 'Set the changed password boolean to true
                 blnPasswordChange = True
         End If

 
should be:
 

'If the password doesn't match that stored in the db then this is a password update
         If rsCommon("Password") <> strEncryptedPassword AND blnConfirmPassOK Then
   If blnEncryptedPasswords Then 
                   'Generate new salt
                   strSalt = getSalt(Len(strPassword))
 
            'Concatenate salt value to the password
              strEncryptedPassword = strPassword & strSalt
            'Re-Genreate encypted password with new salt value
               strEncryptedPassword = HashEncode(strEncryptedPassword)
   Else
    strEncryptedPassword = strPassword
   End If
 
                 'Set the changed password boolean to true
                 blnPasswordChange = True
         End If